dompurify
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/purify.cov.cjs.js | AI (source-diff): Istanbul coverage-instrumented build; new Function('return this') is standard boilerplate, not malicious. | ai | |
| phantom-deps | phantom-dep:@types/trusted-types | AI (phantom-deps): @types/trusted-types is listed as an optionalDependency in package.json; phantom-dep finding is a false positive for this package. | ai |
Versions (showing 53 of 53)
| Version | Deps | Published |
|---|---|---|
| 3.4.11 | 0 / 30 | |
| 3.4.10 | 0 / 30 | |
| 3.4.9 | 0 / 27 | |
| 3.4.8 | 0 / 26 | |
| 3.4.7 | 0 / 26 | |
| 3.4.6 | 0 / 26 | |
| 3.4.5 | 0 / 26 | |
| 3.4.4 | 0 / 26 | |
| 3.4.3 | 0 / 26 | |
| 3.4.2 | 0 / 26 | |
| 3.4.1 | 0 / 26 | |
| 3.4.0 | 0 / 32 | |
| 1.0.11 | 0 / 38 | |
| 1.0.10 | 0 / 38 | |
| 1.0.9 | 0 / 38 | |
| 1.0.8 | 0 / 38 | |
| 1.0.7 | 0 / 38 | |
| 1.0.6 | 0 / 38 | |
| 1.0.5 | 0 / 38 | |
| 1.0.4 | 0 / 38 | |
| 1.0.3 | 0 / 38 | |
| 1.0.2 | 0 / 38 | |
| 1.0.1 | 0 / 38 | |
| 1.0.0 | 0 / 35 | |
| 0.9.0 | 0 / 19 | |
| 0.8.9 | 0 / 19 | |
| 0.8.8 | 0 / 19 | |
| 0.8.7 | 0 / 19 | |
| 0.8.6 | 0 / 19 | |
| 0.8.5 | 0 / 19 | |
| 0.8.4 | 0 / 19 | |
| 0.8.3 | 0 / 19 | |
| 0.8.2 | 0 / 19 | |
| 0.8.1 | 0 / 19 | |
| 0.8.0 | 0 / 19 | |
| 0.7.4 | 0 / 16 | |
| 0.7.3 | 0 / 16 | |
| 0.7.2 | 0 / 16 | |
| 0.7.1 | 0 / 16 | |
| 0.7.0 | 0 / 17 | |
| 0.6.7 | 0 / 14 | |
| 0.6.6 | 0 / 3 | |
| 0.6.5 | 0 / 3 | |
| 0.6.4 | 0 / 3 | |
| 0.6.3 | 0 / 3 | |
| 0.6.2 | 0 / 3 | |
| 0.6.1 | 0 / 3 | |
| 0.6.0 | 0 / 3 | |
| 0.4.5 | 0 / 3 | |
| 0.4.4 | 0 / 3 | |
| 0.4.3 | 0 / 3 | |
| 0.4.2 | 0 / 3 | |
| 0.4.0 | 0 / 3 |
v3.4.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.10
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.